CCI-004057

Defines the frequency for updating commonly used, expected, or compromised passwords, when they are suspected of being compromised directly or indirectly.

Implementation Guidance

Determine if for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [IA-05(01)_ODP[01]; the frequency at which to update the list of commonly used, expected, or compromised passwords is defined] and when Organizational passwords are suspected to have been compromised directly or indirectly.

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; password policy; procedures addressing authenticator management; system security plan; system design documentation; system configuration settings and associated documentation; password configurations and associated documentation; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with authenticator management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers]. Test: [SELECT FROM: Mechanisms supporting and/or implementing password-based authenticator management capability].

The controls below (if any) were marked by NIST as being related to CCI-004057.